If you discover a security vulnerability in SaviTools, please report it responsibly:

1. Do not open a public GitHub issue for security vulnerabilities.
2. Email security concerns to: security@savitura.com
3. Include a detailed description of the vulnerability.
4. If possible, provide steps to reproduce or a proof-of-concept.

We aim to acknowledge reports within 48 hours and will work with you to understand and address the issue promptly.

SaviTools implements the following security measures:

• CORS: Restricted origins via WEB_ORIGIN environment variable
• Rate Limiting: Configurable via THROTTLE_LIMIT and THROTTLE_TTL
• Input Validation: All API inputs are validated using class-validator

• HMAC-SHA256 Signing: Outbound webhooks are signed when WEBHOOK_SIGNING_SECRET is configured
• Timestamp Verification: Replay protection with configurable time window (default 300s)
• Signature Header: X-SaviTools-Signature with format sha256=<hex>

• JWT Tokens: Secure session management with refresh token rotation
• Password Hashing: Argon2 for password storage

• SSRF Protection: Guards on outbound requests from Playground and Webhook modules
• TLS: All external API calls use HTTPS

We appreciate the security research community and will acknowledge researchers who report valid vulnerabilities (with permission) in our release notes.